General Tech Help Good at troubleshooting? Have a non specific issue? Discuss general tech topics here.

CAN bus hacking Jaguar XF

Thread Tools
 
Search this Thread
 
  #1  
Old 05-06-2019, 09:03 AM
Rhys Morgan's Avatar
Member
Thread Starter
Join Date: Nov 2017
Location: kent
Posts: 60
Received 61 Likes on 27 Posts
Default CAN bus hacking Jaguar XF

Hi everyone, not sure wheres best for this thread, but here seems a good place as it is quite generic information that will most likely be the same accross models.

But anyway, initially this has started through wanting to do some kind of upgrade to the builtin media system on my xf, it's an 09 plate with all the extras, however it really is showing its age. In the past with previous cars I have gone the route of "in car pcs" android tablets running custom firmware etc. However after renting a hire car with android auto I fell in love with that. So initially I started with getting android auto running on a raspberry pi, crudely mounted above the builtin screen. It's been there about a month now, works really well, looking into perhaps 3d printing some brackets to get it a bit more secure etc.

Here's a vid of it in action


So this then led me onto the trail of thinking about replacing the screen, having done some work with canbus in industry I have a bit of knowledge so ordered a raspberry pi and pican2, and got cracking on decoding some of the messages, see the below video of the first messages being sent back to the screen, these include skip forward/back, volume up/down.



Since that video I have decoded all messages on the control panel where the cd player is, some messages for seats and climate control. I have begun a git project to track them, and also written a small guide on the readme, I have put this one of the Facebook xf pages, and got pretty good reception, so if anyone on here wants to have a crack and collaborate any messages on the git then that would be awesome.

https://github.com/rhysmorgan134/JaguarXf_CAN

Cheers
 

Last edited by GGG; 05-07-2019 at 02:41 AM. Reason: Thread title
The following 3 users liked this post by Rhys Morgan:
davetibbs (05-09-2019), fivel (07-27-2020), Poppa doing it (10-29-2020)
  #2  
Old 05-06-2019, 05:44 PM
Join Date: Jan 2011
Location: Sydney, Australia
Posts: 8,638
Received 4,435 Likes on 2,421 Posts
Default

It's an interesting project and I hope that you can make it work the way you want to.

One of my colleagues already did some work on a project with this touchscreen system (same platform in X150 XK, also X250 XF up to 2011MY).

CAN is only one piece of the puzzle, you might have already seen that there is no CAN connection directly to the touchscreen, or to the audio control module, only MOST.

The ICM (Infotainment Control Module), the slim black box mounted between the head unit and the touchscreen, is a gateway, converts MS-CAN messages to MOST and vice-versa.

There are some messages which are strictly on MOST, and don't get transferred to CAN.

He's of the opinion that removing the factory touchscreen completely won't be an option. But if you want to do new things on the factory touchscreen, the software / operating system in the touchscreen has been more or less fully reverse-engineered, so it's possible to alter the menus, images, etc

All of the WinCE library for the screen operating system has been disassembled, and a modified OS can be loaded by USB stick directly to the screen.
 
  #3  
Old 05-08-2019, 04:07 PM
Rhys Morgan's Avatar
Member
Thread Starter
Join Date: Nov 2017
Location: kent
Posts: 60
Received 61 Likes on 27 Posts
Default

Originally Posted by Cambo
It's an interesting project and I hope that you can make it work the way you want to.

One of my colleagues already did some work on a project with this touchscreen system (same platform in X150 XK, also X250 XF up to 2011MY).

CAN is only one piece of the puzzle, you might have already seen that there is no CAN connection directly to the touchscreen, or to the audio control module, only MOST.

The ICM (Infotainment Control Module), the slim black box mounted between the head unit and the touchscreen, is a gateway, converts MS-CAN messages to MOST and vice-versa.

There are some messages which are strictly on MOST, and don't get transferred to CAN.

He's of the opinion that removing the factory touchscreen completely won't be an option. But if you want to do new things on the factory touchscreen, the software / operating system in the touchscreen has been more or less fully reverse-engineered, so it's possible to alter the menus, images, etc

All of the WinCE library for the screen operating system has been disassembled, and a modified OS can be loaded by USB stick directly to the screen.
Wow that's some pretty interesting info, do you know where abouts the WinCE library can be found?

I have already pretty much conceded that the MOST bus is going to be a blocker to complete removal, it's a shame as on my cl500 there are after market adapters to allow normal headunit to function over the MOST bus, however doesn't seem to be anything out there for the XF, or any jag for that matter.

In my head currently the best case scenario is to install the screen over the top of the old, and just rely on the aux input, on benefit of this is that certain messages most likely won't be decoded, ie tpms error. As (thankfully) my car does not have every error present to decode...... However I'm sure these details would be contained in the original library some where
 
The following users liked this post:
davetibbs (05-09-2019)
  #4  
Old 05-09-2019, 08:31 PM
davetibbs's Avatar
Veteran Member
Join Date: May 2014
Location: San Francisco, CA
Posts: 1,181
Received 469 Likes on 279 Posts
Default

Great work Rhys, and thanks so much for sharing on github! Thanks also for the info Cambo.

I'm happy to get more into this and maybe send some PRs over if I make any progress - I'd already ordered a canbus interface to get on this but as always other things such as reworking the dash for vac/boost & oil pressure/temp gauge installation have taken up what little free time I have to do car work recently. Hopefully this can change soon though, would love to help to nail a solution to screen replacement.
 
  #5  
Old 05-10-2019, 02:34 AM
Rhys Morgan's Avatar
Member
Thread Starter
Join Date: Nov 2017
Location: kent
Posts: 60
Received 61 Likes on 27 Posts
Default

Sounds awesome, Its gotten quite a bit of traction on an xf Facebook group, someone who designs Web sites has volunteered to help design a front end for it which is handy as that's not my strong point. Just for an overview of how the archeticure is currently (this I very up in the air, just cobbled to get her as I went along)

1x pi running android auto, subscribed to CAN pi through mqtt
1x pi with CAN hat, running as a wireless access point, also running as mqtt broker

The CAN pi receives all messages, filters and listens for relevant ones, when a message is received publishes it over mqtt, second pi then translates to virtual key press which is then linked to android auto, ie skip back etc. When I integrate controls from the pi to the can bus, the CAN pi will be subscribed to a second topic and then the 2nd pi will publish the command.

This is very much open, and any thoughts are welcome. But I do like the idea of using a pi as a wireless access point, this allows raspberry pi's (and arduino if needed) to kind of mimic the OEM module system, ie we want to add a HD reversing camera, just add a pi zero with camera, then listen for the in reverse CAN message to stream cam feed.
 
  #6  
Old 08-04-2019, 02:12 AM
DoctorDbx's Avatar
Junior Member
Join Date: Aug 2019
Location: Brisbane
Posts: 2
Likes: 0
Received 0 Likes on 0 Posts
Default

I'm totally interested in getting involved in this project. Rhys can I chat to you somehow?
 
  #7  
Old 10-20-2019, 12:02 PM
Rhys Morgan's Avatar
Member
Thread Starter
Join Date: Nov 2017
Location: kent
Posts: 60
Received 61 Likes on 27 Posts
Default

Sorry guys, and @DoctorDbx , been pretty busy with my wifes freelander (now fully kitted with 2x pi's, its much easier to fit into there) But I have made some pretty significant progress on this now. I got a facebook message from someone (not sure how they heard about the project, perhaps on here, youtube or facebook) and they were looking into doing similar. But they had the idea of replacing the front control panel with a screen, which I hadnt even though of, but its a perfect Idea, I had already decoded all the button presses for this panel. So the last week been looking back into this, and what was concerning, was the led indicators on the buttons, as we probably all know the car automatically turns on the heated front windscreen etc under certain conditions. So I tried to decode the can messages for these, however when you press one of these buttons, it causes so many systems to begin broadcasting it was almost impossible.

Over on the freel2 forums theres some guys who are really into modifying modules etc with SDD, and have great knowledge of the can bus (looking you @Vanny if you happen to come accross this), anyway one of them had pretty much the entire of a freelander 2 interior set up as a test bench, so I followed suit and bought the control panel from ebay, and that made verifying the buttons and related messages fairly straight forward. However getting the response to bring the light on was still miffing me. Hours and hours of digging through SDD software and trying to look into some of the encrypted files on there got me no where. So I wrote some can decoding software in NodeJs. And today managed to crack it, and then even take complete control of the panel (see video below )


So now we are pretty much there, I will begin work on the UI next, get that integrated to all the new can messages. The pi is an excruciatingly close fit into the hole where the control panel goes, so will remove my panel at somepoint and give it a test fit, but then we should be good to go.

As always the messages and the decoding program I made will be put on git https://github.com/rhysmorgan134/JaguarXf_CAN (needs an update for a ton of stuff) and as always if anyone wants to get involved then send me a PM on here, or find me facebook etc.
 
The following 3 users liked this post by Rhys Morgan:
DGL (11-11-2019), hafren (10-21-2019), Sean W (11-11-2019)
  #8  
Old 10-21-2019, 10:02 PM
allenman85's Avatar
Senior Member
Join Date: Aug 2014
Location: Dallas, Texas
Posts: 465
Received 64 Likes on 53 Posts
Default

Very cool! I have not looked into the lower-speed bus on Jag. I have played around on the high speed bus only.
 
  #9  
Old 10-22-2019, 03:58 AM
Rhys Morgan's Avatar
Member
Thread Starter
Join Date: Nov 2017
Location: kent
Posts: 60
Received 61 Likes on 27 Posts
Default

The high speed will be my next thing to look into, once the UI is done, I can see about finally getting a temperature gauge

Have you found any useful messages on the highspeed? I could use the OBD process and request the info, but i think its much cleaner to pick up on the already existing messages if they can be found
 
  #10  
Old 10-23-2019, 09:06 PM
allenman85's Avatar
Senior Member
Join Date: Aug 2014
Location: Dallas, Texas
Posts: 465
Received 64 Likes on 53 Posts
Default

No, I have no info on what's being broadcast. The OBD is fast enough for temperature. Are you looking to drive old-school gauges or a phone? I built a CAN to old-school gauge converter a while back is why I ask.
 
  #11  
Old 10-24-2019, 03:18 AM
Rhys Morgan's Avatar
Member
Thread Starter
Join Date: Nov 2017
Location: kent
Posts: 60
Received 61 Likes on 27 Posts
Default

I'm thinking of just displaying some details on the touch screen, perhaps coolant/oil temp, and perhaps a few other bits. It may be easier to request them using the obd2 protocol than trying to sniff them out on the bus. I have bought a set of 2009 gauges from ebay for a total of £15 so should be able to figure out quite a bit of info from that off the car.
 
  #12  
Old 11-02-2019, 04:09 PM
Rhys Morgan's Avatar
Member
Thread Starter
Join Date: Nov 2017
Location: kent
Posts: 60
Received 61 Likes on 27 Posts
Default

Newest update:

Created the front end display, also linked to a pretty solid back end server, and done some live testing on the car!!!

Vid below, over the next few days, should get round to a test fit/removal of the old panel, and then looking into some nice to have can Ids. My cluster turned up today, so will do some bench testing on that and see what info I can get out. But a useable solution isn't to far off now.

 
The following 3 users liked this post by Rhys Morgan:
DGL (11-11-2019), hafren (11-07-2019), Sean W (11-11-2019)
  #13  
Old 11-10-2019, 10:51 AM
Rhys Morgan's Avatar
Member
Thread Starter
Join Date: Nov 2017
Location: kent
Posts: 60
Received 61 Likes on 27 Posts
Default

Latest update, version 1 is pretty much done and tested. I have even done a physical fit test and it fits in the space perfectly. In the video below you can see the new UI and also testing of most functions (they all work) next steps to package the app up, and get it integrated to android auto. I've then got a few accessories to get, sound card, 12 to 5v convertor etc then I can proper fit it all.

Going to get a website going with some detailed instructions incase someone wants to give it a go


 
The following 4 users liked this post by Rhys Morgan:
Cambo (11-10-2019), DGL (11-11-2019), jahummer (11-11-2019), Sean W (11-11-2019)
  #14  
Old 11-11-2019, 01:45 PM
Sean W's Avatar
Veteran Member
Join Date: Jun 2013
Location: USA
Posts: 8,330
Received 4,164 Likes on 2,334 Posts
Default

This is very cool. You're getting closer to an install I see. Some of us are watching with interest on the X150 forum. May be too early but what are your plans for this aside from your car? Specifically, once you get the screen(s) all looking perdy and you've completed the final install, will you be creating a kit, or instructions and downloadable software?

I only have a rudimentary understanding of Canbus so this has been a great thread to follow.
 
The following 2 users liked this post by Sean W:
DGL (11-11-2019), TraxtarXKR (11-11-2019)
  #15  
Old 11-11-2019, 06:36 PM
Rhys Morgan's Avatar
Member
Thread Starter
Join Date: Nov 2017
Location: kent
Posts: 60
Received 61 Likes on 27 Posts
Default

Originally Posted by Sean W
This is very cool. You're getting closer to an install I see. Some of us are watching with interest on the X150 forum. May be too early but what are your plans for this aside from your car? Specifically, once you get the screen(s) all looking perdy and you've completed the final install, will you be creating a kit, or instructions and downloadable software?

I only have a rudimentary understanding of Canbus so this has been a great thread to follow.
It's all going to be free and open source, what I'm going to do is start my own website up for it, host some detailed instructions on both how to install and set up, but also how to get involved and contribute if people want to, some crazy things can be done with can bus, so the more people experimenting the better. If people use it and like it, I'll set up a donations thing, the money will just go back into the project in some way anyway.

For those not too technical, I'll make an install script, so literally download one script, execute it with a one line command and then the script will download everything and install it for you. Hardware wise (I can only talk from the xf) it's just a case of supplying power and wiring two wires to the canbus in place of where the panel used to be, and then aux in. Funnily enough the part that's most frustrating me is gracefully shutting down the raspberry pi to prevent sd card corruption. It can be done with relays, timers etc but it just feels too antiquated to go that route when you have access to the entire bus of the car.

Currently in my wife's free lander I just have a script that detects when her phones unplugged (obviously for Android auto the phone needs plugging in) it then turns the pi off. So there's ways round it, I just need to have a proper think on that subject, maybe relays will be the way to go, we will see
 
The following 4 users liked this post by Rhys Morgan:
DGL (11-11-2019), hafren (11-11-2019), Sean W (11-11-2019), TexasTraveler (11-13-2019)
  #16  
Old 11-11-2019, 07:15 PM
Sean W's Avatar
Veteran Member
Join Date: Jun 2013
Location: USA
Posts: 8,330
Received 4,164 Likes on 2,334 Posts
Default

Originally Posted by Rhys Morgan
It's all going to be free and open source, what I'm going to do is start my own website up for it, host some detailed instructions on both how to install and set up, but also how to get involved and contribute if people want to, some crazy things can be done with can bus, so the more people experimenting the better. If people use it and like it, I'll set up a donations thing, the money will just go back into the project in some way anyway.

For those not too technical, I'll make an install script, so literally download one script, execute it with a one line command and then the script will download everything and install it for you. Hardware wise (I can only talk from the xf) it's just a case of supplying power and wiring two wires to the canbus in place of where the panel used to be, and then aux in. Funnily enough the part that's most frustrating me is gracefully shutting down the raspberry pi to prevent sd card corruption. It can be done with relays, timers etc but it just feels too antiquated to go that route when you have access to the entire bus of the car.

Currently in my wife's free lander I just have a script that detects when her phones unplugged (obviously for Android auto the phone needs plugging in) it then turns the pi off. So there's ways round it, I just need to have a proper think on that subject, maybe relays will be the way to go, we will see
Thanks for the reply. I fall partly, well mostly, in the second category. I don't code. I did some work incorporating an Android Media Box into the X150 but that's small potatoes compared to this.
As for shutting down RPI, one might run a random app in RPI and then have "Tasker app" execute a shut down when that app stops which it could on shut down. That app would prolly have to be tied to the ignition, like Torque Pro tho. I'm too novice in what you're doing to offer sound advice though.

I've guinea pigged my car for others on the X150, so count me in when you get there.
 
The following users liked this post:
DGL (11-11-2019)
  #17  
Old 11-13-2019, 08:21 AM
DGL's Avatar
DGL
DGL is offline
Veteran Member
Join Date: Dec 2012
Location: Canada
Posts: 2,990
Received 926 Likes on 607 Posts
Default

This is a huge upgrade, much anticipated. What is the reasonable ETA ? Removing the 3 buttons below the screen, fitting a large good quality android tablet to fill the complete space, with sturdy fasteners, and a good quality trim piece to make it look OEM would be fantastic. This will add another level of functionality to our cars.
 
  #18  
Old 11-22-2019, 09:16 PM
Rhys Morgan's Avatar
Member
Thread Starter
Join Date: Nov 2017
Location: kent
Posts: 60
Received 61 Likes on 27 Posts
Default

Originally Posted by DGL
This is a huge upgrade, much anticipated. What is the reasonable ETA ? Removing the 3 buttons below the screen, fitting a large good quality android tablet to fill the complete space, with sturdy fasteners, and a good quality trim piece to make it look OEM would be fantastic. This will add another level of functionality to our cars.

ETA is hard to say, in terms of when it will be installed and useable, I'd say a few weeks, full completion alot longer, got plenty planned, but no time!

It's not quite an android tablet, the pi will be running Linux, but that means an even more potential from the system
 
  #19  
Old 12-08-2019, 11:03 AM
Rhys Morgan's Avatar
Member
Thread Starter
Join Date: Nov 2017
Location: kent
Posts: 60
Received 61 Likes on 27 Posts
Default

Another update on the android auto project, I've now got the jag app all embedded with the open auto software, and it's working pretty seamlessly. Videos good for people who have never seen the open auto project, as it shows how the main program works.

The jag app is now packaged into a .appimage file so can just be double clicked on and it will run (it does need the pican hat to be installed on the pi) so if anyone wants to have a play feel free.

Hopefully the permanent install will be happening tomorrow once the last couple of pieces of the puzzle arrive.


 
The following 4 users liked this post by Rhys Morgan:
DGL (12-08-2019), hafren (12-08-2019), Sean W (12-08-2019), _jagart (12-08-2019)
  #20  
Old 12-08-2019, 02:59 PM
DGL's Avatar
DGL
DGL is offline
Veteran Member
Join Date: Dec 2012
Location: Canada
Posts: 2,990
Received 926 Likes on 607 Posts
Default

Damn, would love to have this on my 2014 XKR. I assume you can stream music to it. Nice work.
 


Quick Reply: CAN bus hacking Jaguar XF



All times are GMT -5. The time now is 05:09 PM.